Mocking HTTP APIs With Burp

2019-11-08Shea Polanskyhttps://polansky.co@0x5ca1e5

Shea Polansky

Motivation

• Simple HTTP Response Mocking– "isAdmin": false → "isAdmin": true

• Complex Application Manipulation– When built-in regex rules won’t cut it

Example Use Case: DRM BypassGET /api/license?uid=<…>

{"license":

base64

"signatures":

,

{"cert": "…","CA": "…","signature":

}

base64

{"uid": <…>, "user": "…", "expiration": "…", …

}

base64

, …<pkcs7 signature data>base64

}

Example Use Case: DRM Bypass

• This protocol is wack• App requires response in <2s• Want other calls to go through as normal• Normally would have to write a custom Burp

plugin• With this, just need a quick python script!

Burp HTTP Mock Extension

• Originally by Michal Dardas• I added dynamic mocking• Matches requests by regex, either lets

through or transparently redirects to static/dynamic mock

Demo!

Demo!

Installation

• In the BApp Store– Search “HTTP Mock”

• From my GitHub– Slightly faster updates– https://github.com/ise-spolansky/BurpHttpMock

Questions?

GitHub PortSwigger BApp Store

Thank you!2019-11-08Shea Polanskyhttps://polansky.co@0x5ca1e5